Netty MadeYouReset HTTP/2 DDoS Vulnerability
Summary
Netty MadeYouReset HTTP/2 DDoS Vulnerability
Original description
The description as published by the source.
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-55163 netty Fixed in: 1:4.1.48-4+deb11u3
- Ubuntu UBUNTU-CVE-2025-55163 netty
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web openwall.com
- web kb.cert.org